03.01.12: Remote Access
Control Family:
CSF v2.0 References:
Previous Version:
- NIST Special Publication 800-171 Revision 2:
- 3.1.12: Monitor and control remote access sessions
Incorporates the following controls from the previous version of the control set: 3.1.14: Route remote access via managed access control points, 3.1.15: Authorize remote execution of privileged commands and remote access to security-relevant information, 3.13.7: Prevent remote devices from simultaneously establishing non-remote connections with organizational systems and communicating via some other connection to resources in external networks (i.e., split tunneling).
Requirements
- Establish usage restrictions, configuration requirements, and connection requirements for each type of allowable remote system access.
- Authorize each type of remote system access prior to establishing such connections.
- Route remote access to the system through authorized and managed access control points.
- Authorize the remote execution of privileged commands and remote access to security-relevant information.
Discussion
Remote access is access to systems (or processes acting on behalf of users) that communicate through external networks, such as the internet. Monitoring and controlling remote access methods allows organizations to detect attacks and ensure compliance with remote access policies. Routing remote access through managed access control points enhances explicit control over such connections and reduces susceptibility to unauthorized access to the system, which could result in the unauthorized disclosure of CUI. Remote access to the system represents a significant potential vulnerability that can be exploited by adversaries. Restricting the execution of privileged commands and access to security-relevant information via remote access reduces the exposure of the organization and its susceptibility to threats by adversaries. A privileged command is a human-initiated command executed on a system that involves the control, monitoring, or administration of the system, including security functions and security-relevant information. Security-relevant information is information that can potentially impact the operation of security functions or the provision of security services in a manner that could result in failure to enforce the system security policy or maintain isolation of code and data. Privileged commands give individuals the ability to execute sensitive, security-critical, or security-relevant system functions.